overhaul cancellation to fix resource leaks and dangerous behavior with signals

this commit addresses two issues:

1. a race condition, whereby a cancellation request occurring after a
syscall returned from kernelspace but before the subsequent
CANCELPT_END would cause cancellable resource-allocating syscalls
(like open) to leak resources.

2. signal handlers invoked while the thread was blocked at a
cancellation point behaved as if asynchronous cancellation mode wer in
effect, resulting in potentially dangerous state corruption if a
cancellation request occurs.

the glibc/nptl implementation of threads shares both of these issues.

with this commit, both are fixed. however, cancellation points
encountered in a signal handler will not be acted upon if the signal
was received while the thread was already at a cancellation point.
they will of course be acted upon after the signal handler returns, so
in real-world usage where signal handlers quickly return, it should
not be a problem. it's possible to solve this problem too by having
sigaction() wrap all signal handlers with a function that uses a
pthread_cleanup handler to catch cancellation, patch up the saved
context, and return into the cancellable function that will catch and
act upon the cancellation. however that would be a lot of complexity
for minimal if any benefit...

diff --git a/arch/i386/pthread_arch.h b/arch/i386/pthread_arch.h
index 155b484732c4a2e5aa496ca8bda23d27ce0d2957..64d75cbcc201c8b08f4be1548c03b2287e178d1a 100644 (file)
--- a/arch/i386/pthread_arch.h
+++ b/arch/i386/pthread_arch.h
@@ -4,3 +4,6 @@ static inline struct pthread *__pthread_self()
        __asm__ ("movl %%gs:0,%0" : "=r" (self) );
        return self;
 }
+
+#define PC_AT_SYS(c) \
+       (*(uint16_t *)(((ucontext_t *)(c))->uc_mcontext.__gregs[14])==0x80cd)

diff --git a/arch/x86_64/pthread_arch.h b/arch/x86_64/pthread_arch.h
index 40d267979b82ae4296566feacfa77a565d8747d6..af7ae86e2b72f726b81671f120a3cb3d2591add9 100644 (file)
--- a/arch/x86_64/pthread_arch.h
+++ b/arch/x86_64/pthread_arch.h
@@ -4,3 +4,6 @@ static inline struct pthread *__pthread_self()
        __asm__ ("movq %%fs:0,%0" : "=r" (self) );
        return self;
 }
+
+#define PC_AT_SYS(c) \
+       (*(uint16_t *)(((ucontext_t *)(c))->uc_mcontext.__gregs[16])==0x050f)

diff --git a/src/internal/libc.h b/src/internal/libc.h
index 3d09bf6aba35bfe1d0c0d00df5783dd6b13beb0a..bbbb3a4cc8047682f4306ea7737df293dc6c762c 100644 (file)
--- a/src/internal/libc.h
+++ b/src/internal/libc.h
@@ -44,7 +44,8 @@ void __lockfile(FILE *);
 #define UNLOCK(x) (*(x)=0)
 #define CANCELPT(x) (libc.cancelpt ? libc.cancelpt((x)),0 : (void)(x),0)
 #define CANCELPT_BEGIN CANCELPT(1)
-#define CANCELPT_END CANCELPT(0)
+#define CANCELPT_TRY CANCELPT(0)
+#define CANCELPT_END CANCELPT(-1)
 
 extern char **__environ;
 #define environ __environ

diff --git a/src/process/waitid.c b/src/process/waitid.c
index b1e5e9b19013998cbcc044246d9a0fd9138af272..4fa7c024df4f221a9e859e1b3b8b125f863c16c7 100644 (file)
--- a/src/process/waitid.c
+++ b/src/process/waitid.c
@@ -1,7 +1,13 @@
 #include <sys/wait.h>
 #include "syscall.h"
+#include "libc.h"
 
 int waitid(idtype_t type, id_t id, siginfo_t *info, int options)
 {
-       return syscall(SYS_waitid, type, id, info, options, 0);
+       int r;
+       CANCELPT_BEGIN;
+       r = syscall(SYS_waitid, type, id, info, options, 0);
+       if (r<0) CANCELPT_TRY;
+       CANCELPT_END;
+       return r;
 }

diff --git a/src/process/waitpid.c b/src/process/waitpid.c
index ec2757b3b30905310510668c6ed3f2f2d93b3a17..5e0320f7b0bb9f2a935d61b73031425a92dddeee 100644 (file)
--- a/src/process/waitpid.c
+++ b/src/process/waitpid.c
@@ -1,7 +1,13 @@
 #include <sys/wait.h>
 #include "syscall.h"
+#include "libc.h"
 
 pid_t waitpid(pid_t pid, int *status, int options)
 {
-       return syscall(SYS_wait4, pid, status, options, 0);
+       int r;
+       CANCELPT_BEGIN;
+       r = syscall(SYS_wait4, pid, status, options, 0);
+       if (r<0) CANCELPT_TRY;
+       CANCELPT_END;
+       return r;
 }

diff --git a/src/select/pselect.c b/src/select/pselect.c
index 63ea0695dbfacda12c7a8e4d965dc70b1aecb751..155a6eb0382ce79a265c9ea10e33d6b89be5e91c 100644 (file)
--- a/src/select/pselect.c
+++ b/src/select/pselect.c
@@ -10,6 +10,7 @@ int pselect(int n, fd_set *rfds, fd_set *wfds, fd_set *efds, const struct timesp
        if (ts) ts_tmp = *ts;
        CANCELPT_BEGIN;
        r = syscall(SYS_pselect6, n, rfds, wfds, efds, ts ? &ts_tmp : 0, data);
+       CANCELPT_TRY;
        CANCELPT_END;
        return r;
 }

diff --git a/src/select/select.c b/src/select/select.c
index 12322718f9e1377ae608fc1dceafdefe66d6d12e..b38e7fd287ca3447a86396cc6cb6d0c3b6a9b421 100644 (file)
--- a/src/select/select.c
+++ b/src/select/select.c
@@ -7,6 +7,7 @@ int select(int n, fd_set *rfds, fd_set *wfds, fd_set *efds, struct timeval *tv)
        int r;
        CANCELPT_BEGIN;
        r = syscall(SYS_select, n, rfds, wfds, efds, tv);
+       CANCELPT_TRY;
        CANCELPT_END;
        return r;
 }

diff --git a/src/signal/sigsuspend.c b/src/signal/sigsuspend.c
index 6c13fce139459171366585118f5ea5c306e3ab73..9ee71240457f34950ab2c683baa05728af0ed5cd 100644 (file)
--- a/src/signal/sigsuspend.c
+++ b/src/signal/sigsuspend.c
@@ -7,6 +7,7 @@ int sigsuspend(const sigset_t *mask)
        int ret;
        CANCELPT_BEGIN;
        ret = syscall(__NR_rt_sigsuspend, mask, 8);
+       if (ret<0) CANCELPT_TRY;
        CANCELPT_END;
        return ret;
 }

diff --git a/src/signal/sigtimedwait.c b/src/signal/sigtimedwait.c
index a0edaaf353a94aee7d5da4d44f12827bb454aa12..86a2c879df751b13027683749af7a9657aa30ce4 100644 (file)
--- a/src/signal/sigtimedwait.c
+++ b/src/signal/sigtimedwait.c
@@ -9,6 +9,7 @@ int sigtimedwait(const sigset_t *mask, siginfo_t *si, const struct timespec *tim
        CANCELPT_BEGIN;
        do {
                ret = syscall(__NR_rt_sigtimedwait, mask, si, timeout, 8);
+               if (ret<0) CANCELPT_TRY;
        } while (ret<0 && errno==EINTR);
        CANCELPT_END;
        return ret;

diff --git a/src/termios/tcdrain.c b/src/termios/tcdrain.c
index 8e889b517a74bff799578b5e8847630f26bbb665..9ff1ecd5629537346c720e444a2f6ab2c37284e1 100644 (file)
--- a/src/termios/tcdrain.c
+++ b/src/termios/tcdrain.c
@@ -7,6 +7,7 @@ int tcdrain(int fd)
        int ret;
        CANCELPT_BEGIN;
        ret = ioctl(fd, TCSBRK, 1);
+       CANCELPT_TRY;
        CANCELPT_END;
        return ret;
 }

diff --git a/src/thread/pthread_cond_timedwait.c b/src/thread/pthread_cond_timedwait.c
index 228f61f706e4cf03e9bea6ad735db685ce371b34..1439aace15de557cb9c22e35a045c5353b857b15 100644 (file)
--- a/src/thread/pthread_cond_timedwait.c
+++ b/src/thread/pthread_cond_timedwait.c
@@ -8,19 +8,21 @@ static void relock(void *m)
 int pthread_cond_timedwait(pthread_cond_t *c, pthread_mutex_t *m, const struct timespec *ts)
 {
        int r, e=0;
-       CANCELPT(0);
+       CANCELPT_BEGIN;
+       CANCELPT_END;
 
        pthread_cleanup_push(relock, m);
        c->_c_block = 1;
        if ((r=pthread_mutex_unlock(m))) return r;
 
-       CANCELPT(1);
+       CANCELPT_BEGIN;
        e = __timedwait(&c->_c_block, 1, c->_c_clock, ts, 0);
-       CANCELPT(0);
+       CANCELPT_END;
 
        pthread_cleanup_pop(0);
        if ((r=pthread_mutex_lock(m))) return r;
 
-       CANCELPT(0);
+       CANCELPT_BEGIN;
+       CANCELPT_END;
        return e;
 }

diff --git a/src/thread/pthread_create.c b/src/thread/pthread_create.c
index 17a47f6ac00fa05fe7c39c80dad99f2de9956110..785a82b87477e3afa91c033d7a53d0089b2fecfd 100644 (file)
--- a/src/thread/pthread_create.c
+++ b/src/thread/pthread_create.c
@@ -42,6 +42,12 @@ void __pthread_unwind_next(struct __ptcb *cb)
 static void docancel(struct pthread *self)
 {
        struct __ptcb cb = { .__next = self->cancelbuf };
+       sigset_t set;
+       self->canceldisable = 1;
+       self->cancelasync = 0;
+       sigemptyset(&set);
+       sigaddset(&set, SIGCANCEL);
+       __libc_sigprocmask(SIG_UNBLOCK, &set, 0);
        __pthread_unwind_next(&cb);
 }
 
@@ -50,17 +56,17 @@ static void cancel_handler(int sig, siginfo_t *si, void *ctx)
        struct pthread *self = __pthread_self();
        if (si->si_code > 0 || si->si_pid != self->pid) return;
        self->cancel = 1;
-       if (self->canceldisable || (!self->cancelasync && !self->cancelpoint))
-               return;
-       docancel(self);
+       if (self->canceldisable) return;
+       if (self->cancelasync || (self->cancelpoint==1 && PC_AT_SYS(ctx)))
+               docancel(self);
 }
 
 static void cancelpt(int x)
 {
        struct pthread *self = __pthread_self();
        if (self->canceldisable) return;
-       self->cancelpoint = x;
-       if (self->cancel) docancel(self);
+       if ((self->cancelpoint+=x)==1 && x>=0 && self->cancel)
+               docancel(self);
 }
 
 /* "rsyscall" is a mechanism by which a thread can synchronously force all

diff --git a/src/thread/sem_timedwait.c b/src/thread/sem_timedwait.c
index ad3bf07581e2a83f01bfcd495b3f244c82ecdbe0..11a017005fc09df08502833431506b2f4e51795f 100644 (file)
--- a/src/thread/sem_timedwait.c
+++ b/src/thread/sem_timedwait.c
@@ -9,15 +9,18 @@ int sem_timedwait(sem_t *sem, const struct timespec *at)
                if (a_fetch_add(sem->__val, -1) > 0) return 0;
                val = a_fetch_add(sem->__val, 1)+1;
                if (val==1) __wake(sem->__val, 1, 0);
-               CANCELPT_BEGIN;
                if (at && at->tv_nsec >= 1000000000UL) {
                        errno = EINVAL;
                        return -1;
                }
+               CANCELPT_BEGIN;
                if (val <= 0 && __timedwait(sem->__val, val, CLOCK_REALTIME, at, 0) == ETIMEDOUT) {
                        errno = ETIMEDOUT;
+                       CANCELPT_TRY;
+                       CANCELPT_END;
                        return -1;
                }
+               CANCELPT_TRY;
                CANCELPT_END;
        }
 }

diff --git a/src/time/nanosleep.c b/src/time/nanosleep.c
index 2f65762f8f5f01981f15c4e4c7c735fc96a898e8..0e0753f3a78a47ee1a6bd862c39e5123ebcef8f5 100644 (file)
--- a/src/time/nanosleep.c
+++ b/src/time/nanosleep.c
@@ -8,6 +8,7 @@ int nanosleep(const struct timespec *req, struct timespec *rem)
        int ret;
        CANCELPT_BEGIN;
        ret = syscall(SYS_nanosleep, req, rem);
+       CANCELPT_TRY;
        CANCELPT_END;
        return ret;
 }